[Beats Management] APIs: Create enrollment tokens

x-pack/plugins/beats/common/constants/index.js

@@ -5,3 +5,4 @@
  */
 
 export { PLUGIN } from './plugin';
+export { INDEX_NAMES } from './index_names';

x-pack/plugins/beats/common/constants/index_names.js

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const INDEX_NAMES = {
+  BEATS: '.management-beats'
+};

x-pack/plugins/beats/index.js

@@ -5,14 +5,23 @@
  */
 
 import { installIndexTemplate } from './server/lib/index_template';
+import { registerApiRoutes } from './server/routes/api';
 import { PLUGIN } from './common/constants';
 
+const DEFAULT_ENROLLMENT_TOKENS_TTL_S = 10 * 60; // 10 minutes
+
 export function beats(kibana)  {
   return new kibana.Plugin({
     id: PLUGIN.ID,
     require: ['kibana', 'elasticsearch', 'xpack_main'],
+    configPrefix: 'xpack.beats',
+    config: Joi => Joi.object({
+      enabled: Joi.boolean().default(true),
+      enrollmentTokensTtlInSeconds: Joi.number().integer().min(1).default(DEFAULT_ENROLLMENT_TOKENS_TTL_S)
+    }).default(),
     init: async function (server) {
       await installIndexTemplate(server);
+      registerApiRoutes(server);
     }
   });
 }

x-pack/plugins/beats/server/lib/call_with_request_factory/call_with_request_factory.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { once } from 'lodash';
+
+const callWithRequest = once((server) => {
+  const config = server.config().get('elasticsearch');
+  const cluster = server.plugins.elasticsearch.createCluster('beats', config);
+  return cluster.callWithRequest;
+});
+
+export const callWithRequestFactory = (server, request) => {
+  return (...args) => {
+    return callWithRequest(server)(request, ...args);
+  };
+};

x-pack/plugins/beats/server/lib/call_with_request_factory/index.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { callWithRequestFactory } from './call_with_request_factory';

x-pack/plugins/beats/server/lib/error_wrappers/index.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { wrapEsError } from './wrap_es_error';

x-pack/plugins/beats/server/lib/error_wrappers/wrap_es_error.js

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Boom from 'boom';
+
+/**
+ * Wraps ES errors into a Boom error response and returns it
+ * This also handles the permissions issue gracefully
+ *
+ * @param err Object ES error
+ * @return Object Boom error response
+ */
+export function wrapEsError(err) {
+  const statusCode = err.statusCode;
+  if (statusCode === 403) {
+    return Boom.forbidden('Insufficient user permissions for managing Beats configuration');
+  }
+  return Boom.wrap(err, err.statusCode);
+}

x-pack/plugins/beats/server/lib/error_wrappers/wrap_es_error.test.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { wrapEsError } from './wrap_es_error';
+
+describe('wrap_es_error', () => {
+  describe('#wrapEsError', () => {
+
+    let originalError;
+    beforeEach(() => {
+      originalError = new Error('I am an error');
+      originalError.statusCode = 404;
+    });
+
+    it('should return a Boom object', () => {
+      const wrappedError = wrapEsError(originalError);
+
+      expect(wrappedError.isBoom).to.be(true);
+    });
+
+    it('should return the correct Boom object', () => {
+      const wrappedError = wrapEsError(originalError);
+
+      expect(wrappedError.output.statusCode).to.be(originalError.statusCode);
+      expect(wrappedError.output.payload.message).to.be(originalError.message);
+    });
+
+    it('should return invalid permissions message for 403 errors', () => {
+      const securityError = new Error('I am an error');
+      securityError.statusCode = 403;
+      const wrappedError = wrapEsError(securityError);
+
+      expect(wrappedError.isBoom).to.be(true);
+      expect(wrappedError.message).to.be('Insufficient user permissions for managing Logstash pipelines');
+    });
+  });
+});

x-pack/plugins/beats/server/routes/api/index.js

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { registerCreateEnrollmentTokensRoute } from './register_create_enrollment_tokens_route';
+
+export function registerApiRoutes(server) {
+  registerCreateEnrollmentTokensRoute(server);
+}

x-pack/plugins/beats/server/routes/api/register_create_enrollment_tokens_route.js

@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+import uuid from 'uuid';
+import moment from 'moment';
+import {
+  get,
+  flatten
+} from 'lodash';
+import { INDEX_NAMES } from '../../../common/constants';
+import { callWithRequestFactory } from '../../lib/call_with_request_factory';
+import { wrapEsError } from '../../lib/error_wrappers';
+
+function persistTokens(callWithRequest, tokens, enrollmentTokensTtlInSeconds) {
+  const enrollmentTokenExpiration = moment().add(enrollmentTokensTtlInSeconds, 'seconds').toJSON();
+  const body = flatten(tokens.map(token => [
+    { index: { _id: `enrollment_token:${token}` } },
+    { type: 'enrollment_token', enrollment_token: { token, expires_on: enrollmentTokenExpiration } }
+  ]));
+
+  const params = {
+    index: INDEX_NAMES.BEATS,
+    type: '_doc',
+    body,
+    refresh: 'wait_for'
+  };
+
+  return callWithRequest('bulk', params);
+}
+
+// TODO: add license check pre-hook
+// TODO: write to Kibana audit log file
+export function registerCreateEnrollmentTokensRoute(server) {
+  const DEFAULT_NUM_TOKENS = 1;
+  const enrollmentTokensTtlInSeconds = server.config().get('xpack.beats.enrollmentTokensTtlInSeconds');
+
+  server.route({
+    method: 'POST',
+    path: '/api/beats/enrollment_tokens',
+    config: {
+      validate: {
+        payload: Joi.object({
+          num_tokens: Joi.number().optional().default(DEFAULT_NUM_TOKENS).min(1)
+        }).allow(null)
+      }
+    },
+    handler: async (request, reply) => {
+      const callWithRequest = callWithRequestFactory(server, request);
+      const numTokens = get(request, 'payload.num_tokens', DEFAULT_NUM_TOKENS);
+
+      const tokens = [];
+      while (tokens.length < numTokens) {
+        tokens.push(uuid.v4().replace(/-/g, ""));
+      }
+
+      try {
+        await persistTokens(callWithRequest, tokens, enrollmentTokensTtlInSeconds);
+      } catch (err) {
+        return reply(wrapEsError(err));
+      }
+
+      const response = { tokens };
+      reply(response);
+    }
+  });
+}

x-pack/test/api_integration/apis/beats/create_enrollment_token.js

@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from 'expect.js';
+import moment from 'moment';
+
+export default function ({ getService }) {
+  const supertest = getService('supertest');
+  const chance = getService('chance');
+  const es = getService('es');
+
+  const ES_INDEX_NAME = '.management-beats';
+  const ES_TYPE_NAME = '_doc';
+
+  describe('create_enrollment_token', () => {
+    const cleanup = () => {
+      return es.indices.delete({
+        index: ES_INDEX_NAME,
+        ignore: [ 404 ]
+      });
+    };
+
+    beforeEach(cleanup);
+    afterEach(cleanup);
+
+    it('should create one token by default', async () => {
+      const { body: apiResponse } = await supertest
+        .post(
+          '/api/beats/enrollment_tokens'
+        )
+        .set('kbn-xsrf', 'xxx')
+        .send()
+        .expect(200);
+
+      const tokensFromApi = apiResponse.tokens;
+
+      const esResponse = await es.search({
+        index: ES_INDEX_NAME,
+        type: ES_TYPE_NAME,
+        q: 'type:enrollment_token'
+      });
+
+      const tokensInEs = esResponse.hits.hits
+        .map(hit => hit._source.enrollment_token.token);
+
+      expect(tokensFromApi.length).to.eql(1);
+      expect(tokensFromApi).to.eql(tokensInEs);
+    });
+
+    it('should create the specified number of tokens', async () => {
+      const numTokens = chance.integer({ min: 1, max: 2000 });
+
+      const { body: apiResponse } = await supertest
+        .post(
+          '/api/beats/enrollment_tokens'
+        )
+        .set('kbn-xsrf', 'xxx')
+        .send({
+          num_tokens: numTokens
+        })
+        .expect(200);
+
+      const tokensFromApi = apiResponse.tokens;
+
+      const esResponse = await es.search({
+        index: ES_INDEX_NAME,
+        type: ES_TYPE_NAME,
+        q: 'type:enrollment_token',
+        size: numTokens
+      });
+
+      const tokensInEs = esResponse.hits.hits
+        .map(hit => hit._source.enrollment_token.token);
+
+      expect(tokensFromApi.length).to.eql(numTokens);
+      expect(tokensFromApi).to.eql(tokensInEs);
+    });
+
+    it('should set token expiration to 10 minutes from now by default', async () => {
+      await supertest
+        .post(
+          '/api/beats/enrollment_tokens'
+        )
+        .set('kbn-xsrf', 'xxx')
+        .send()
+        .expect(200);
+
+      const esResponse = await es.search({
+        index: ES_INDEX_NAME,
+        type: ES_TYPE_NAME,
+        q: 'type:enrollment_token'
+      });
+
+      const tokenInEs = esResponse.hits.hits[0]._source.enrollment_token;
+
+      // We do a fuzzy check to see if the token expires between 9 and 10 minutes
+      // from now because a bit of time has elapsed been the creation of the
+      // tokens and this check.
+      const tokenExpiresOn = moment(tokenInEs.expires_on).valueOf();
+      const tenMinutesFromNow = moment().add('10', 'minutes').valueOf();
+      const almostTenMinutesFromNow = moment(tenMinutesFromNow).subtract('2', 'seconds').valueOf();
+      expect(tokenExpiresOn).to.be.lessThan(tenMinutesFromNow);
+      expect(tokenExpiresOn).to.be.greaterThan(almostTenMinutesFromNow);
+    });
+  });
+}

x-pack/test/api_integration/apis/beats/index.js

@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function ({ loadTestFile }) {
+  describe('beats', () => {
+    loadTestFile(require.resolve('./create_enrollment_token'));
+  });
+}

x-pack/test/api_integration/apis/index.js

@@ -11,5 +11,6 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./xpack_main'));
     loadTestFile(require.resolve('./reporting'));
     loadTestFile(require.resolve('./logstash'));
+    loadTestFile(require.resolve('./beats'));
   });
 }

x-pack/test/api_integration/config.js

@@ -22,6 +22,7 @@ export default async function ({ readConfigFile }) {
       supertestWithoutAuth: SupertestWithoutAuthProvider,
       es: kibanaCommonConfig.get('services.es'),
       esArchiver: kibanaCommonConfig.get('services.esArchiver'),
+      chance: kibanaAPITestsConfig.get('services.chance'),
     },
     esArchiver: xPackFunctionalTestsConfig.get('esArchiver'),
     junit: {